Winsock and Sniffing

[1Rover1]

This question may be a little too low-level to be winsock specific but anyways...

If I have a winsock app running on my machine listening on port X, and on the same machine I open a telnet session to connect to port X - would this still broadcast the packets over a network or would windows be smart enough to keep the network broadcast out of the loop?

I'm working on a proxy client and proxy server app that will encrypt packets between the two so that sniffers can't pick up and easily read what is being transferred, and this would be worth naught if the said packets get broadcast anyway.

Thanks for help.

[csammis]

This would depend on how you connect to yourself. If you're connected to a network and you use your full IP address, the packet goes out to the nearest router and back to you, but it *does* travel over the network. If you telnet to localhost, or 127.0.0.1 (localhost's IP), then your packet just goes up and down the TCP stack and doesn't travel over the public network.

Hope this helps!

[1Rover1]

Thanks for the reply. Here the scenario:

A small peer-to-peer network ( <10 computers), no switches, routers, DNS, everybody gets everybody elses noise. Since there are no reasons to contact a server one would hope that developers of such basic network functions would make it check local details before broadcasting to a network.

[csammis]

I'm not sure if the creators of the socket interface for Windows were thinking that hard when they wrote it, but here's how you might find out:

Go to a command prompt on one of the machines on your peer-to-peer network (I'm assuming it's running Windows, if it's a *nix get to a command line) and type "tracert machine-name" (or "traceroute" on a *nix), where "machine-name" is the name of another of your peer-to-peer connected machines. It'll spit out the route that a packet takes to get to that computer. Here's a sample output:

C:\>tracert yahoo.com

Tracing route to yahoo.com [216.115.108.245]
over a maximum of 30 hops:

1 151 ms 150 ms 150 ms ipt-fa02.proxy.aol.com [205.188.192.91]
2 150 ms 150 ms 150 ms tot-dr5-G1-0.proxy.aol.com [205.188.192.124]
3 150 ms 150 ms 150 ms wc2-dtc-P5-1.aol.com [205.188.170.25]
4 150 ms 150 ms 151 ms pop2-dtc-P1-0.atdn.net [204.148.102.33]
5 150 ms 160 ms 151 ms level3.atdn.net [204.148.99.202]
6 241 ms 240 ms 230 ms loopback1.aol1.SanJose1.Level3.net [166.90.50.191]
7 240 ms 230 ms 241 ms loopback0.core2.SanJose1.Level3.net [209.244.2.234]
8 230 ms 231 ms 240 ms 209.244.13.86
9 230 ms 230 ms 231 ms POS11-0.ipcolo3.SanJose1.Level3.net [209.244.13.58]
10 210 ms 211 ms 220 ms 64.152.69.18
11 220 ms 211 ms 210 ms UNKNOWN.yahoo.com [216.115.100.150]
12 221 ms 210 ms 210 ms vl20.bas1.snv.yahoo.com [216.115.100.225]
13 220 ms 220 ms 210 ms img5.yahoo.com [216.115.108.245]

Trace complete.

As you can see, I'm on a computer running AOL (blech), and in order to get to "yahoo.com", the packet has to travel through all sorts of routers, any one of which might be sniffing packets or something. If there are no strange machines in your output (that is, a machine not on your network), then it doesn't travel through an outside source.

[1Rover1]

Okay. Last night at home I got around to having a look with a sniffer. When I ping myself it generated packets - this is strange because you can still ping yourself when you pull the network plug.

Anyway, if found out that none of the packets got broadcast when connecting to myself. I connected to my LAN address (192.168.1.4), my computer name (JOEL), and my local address (127.0.0.1) and neither of them generated packets.

So whether this is the rule or the exception remains to be seen but in that particular case I got favourable results.

Now I can get back to secure web surfing

[JoshT]

When I ping myself it generated packets - this is strange because you can still ping yourself when you pull the network plug.

If you can ping yourself, it verifies TCP/IP is working.